From: Eduard Zingerman <eddyz87@gmail.com>
To: Hao Sun <sunhao.th@gmail.com>
Cc: bpf@vger.kernel.org, andreimatei1@gmail.com, ast@kernel.org,
andrii@kernel.org, daniel@iogearbox.net,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH bpf] bpf: Reject pointer spill with var offset
Date: Thu, 25 Jan 2024 15:05:31 +0200 [thread overview]
Message-ID: <9a39fe710042c71abb252a38e1ec1bbfbe291e52.camel@gmail.com> (raw)
In-Reply-To: <CACkBjsZjYewSh4ZHFbj-D_Z7kGOeaVLfROcEDE1beNEDn-aU-A@mail.gmail.com>
On Thu, 2024-01-25 at 09:34 +0100, Hao Sun wrote:
[...]
> Testing this case with test_progs/test_verifier is hard because it happens
> when cpu_mitigations_off() is true, but we do not have this setup yet.
> So the mentioned prog is rejected by sanitize_check_bounds() due to ptr
> alu with var_off when adding it to test_progs, and loading as unpriv.
>
> My local test was conducted: (1) booting the kernel with "mitigations=off"
> so that bypass_spec_v1 is true and sanitize_check_bounds() is skipped;
> (2) running the prog without the patch leaks the pointer; (3) loading the
> prog with the patch applied resulting in the expected message.
Thank you for explaining.
I booted VM with "mitigations=off" and tried test as in [1], it passes.
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
[1] https://gist.github.com/eddyz87/bb517437767a8f01891cc6e6a847d448
prev parent reply other threads:[~2024-01-25 13:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-24 10:30 [PATCH bpf] bpf: Reject pointer spill with var offset Hao Sun
2024-01-25 1:35 ` Eduard Zingerman
2024-01-25 8:34 ` Hao Sun
2024-01-25 13:05 ` Eduard Zingerman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9a39fe710042c71abb252a38e1ec1bbfbe291e52.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=andreimatei1@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=linux-kernel@vger.kernel.org \
--cc=sunhao.th@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.